AI Is Supercharging Hacking — Are We Ready?

Janice Malone's phone started ringing in March, and it barely stopped. Callers from across her network of small business owners wanted to know the same thing: Why was someone trying to move money out of their accounts? Malone runs Vivian's Door, an Alabama nonprofit that provides training, resources, and community to underserved and minority-owned businesses. To do that work well, her organization often handles the financial data of the companies it serves — data stored on Vivian's Door systems. When those concerned calls began arriving, Malone was staring at a problem that security researchers say is spreading through America's smallest institutions at a pace nobody is prepared for: an intrusion that didn't look like the clumsy phishing attempts of five years ago.

What hit Vivian's Door fits a pattern that incident responders now see weekly. Attacks built or accelerated with artificial intelligence are cheaper to launch, harder to spot, and increasingly aimed at organizations that can least afford a bad day. The hospitals and community banks those businesses depend on sit squarely in the blast radius.

How AI Is Transforming the Hacker's Toolkit

The IBM X-Force Threat Intelligence Index has documented a steady climb in the share of intrusions that show signs of AI assistance, with attackers using language models to draft flawless phishing emails, generate convincing fake login pages, and probe for software flaws far faster than human teams can patch them. The Verizon Data Breach Investigations Report tells a parallel story: the overwhelming majority of breaches still begin with some form of social engineering, and AI has made that entry point dramatically more effective. Grammar errors and awkward phrasing once gave scams away. Those tells are gone.

The economics explain the shift. A persuasive phishing campaign that once required a skilled writer can now be assembled in minutes by someone with no technical background at all. Voice-cloning tools let an attacker imitate a company's finance director on a phone call. Automated scanning tools test thousands of logins across hundreds of targets simultaneously, looking for the one account still using an old password.

Government analysts have watched the same trend. The FBI's Internet Crime Complaint Center logs hundreds of thousands of cybercrime complaints each year, with reported losses climbing into the billions of dollars, and the agency has repeatedly warned that AI tools are lowering the barrier to entry for would-be criminals. CISA advisories now routinely flag AI-enabled phishing and deepfake social engineering as threats to organizations of every size — not just the Fortune 500.

Why Small Nonprofits Are Suddenly High-Value Targets

Vivian's Door didn't look like a prize. That's exactly why it was one. Nonprofits, chambers of commerce, and business incubators hold something valuable without the budgets to protect it: personal and financial information belonging to dozens or hundreds of small companies. A single breach at an organization like Malone's can cascade into wire fraud attempts against every business in its network — which is precisely what her callers described.

Security professionals who work with under-resourced groups describe a consistent profile. These organizations run lean. A single staff member often handles IT alongside fundraising and payroll. Multifactor authentication may be optional. Software updates lag. There is rarely a dedicated security budget, let alone a retained incident-response firm.

That gap has become a business model for attackers. Ransomware crews research victims before striking, favoring targets that will pay quickly rather than those with the deepest pockets. Nonprofits also carry reputational stakes that make them pliable: a charity that loses donor data may lose donors entirely. Academic researchers studying cyber risk in the nonprofit sector have found that many groups underestimate their exposure because they assume no one would bother attacking them. The callers in Malone's case suggest otherwise.

Hospitals and Banks: Critical Infrastructure Left Exposed

Regional hospitals and community banks occupy an uncomfortable middle ground: large enough to hold sensitive data at scale, too small to match the security spending of national chains. A single hospital outage can force ambulances to divert, delay surgeries, and push clinical staff back to paper records. Community banks hold the accounts of local businesses, farms, and municipalities, and a successful intrusion can freeze payroll for an entire town.

Federal officials have spent years pushing these sectors to harden their defenses. CISA has issued repeated guidance urging health care providers and financial institutions to close basic gaps — patching known vulnerabilities, enforcing multifactor authentication, segmenting networks so one compromised laptop doesn't hand over the entire system. The FBI has warned that ransomware operators specifically target health care because downtime there creates maximum pressure to pay.

The uncomfortable truth is that many of these institutions still run outdated systems that cannot be patched without disrupting patient care. A rural hospital may depend on a single IT contractor who services a dozen other clients. A community bank may rely on third-party vendors whose own security is opaque. Each of those dependencies is a door.

What Makes AI-Driven Attacks Harder to Detect and Stop

Traditional security advice assumed attacks had fingerprints: a malicious link with odd characters, an email sent at 3 a.m. from an unfamiliar address. AI-generated attacks erase many of those fingerprints. Messages arrive in fluent, context-aware language that mirrors how a real colleague writes. Fake login portals match the real thing down to the logo and loading animation. Automated tools vary their behavior across targets so that no single signature triggers a defense system.

For a small organization, the detection problem is even more basic. Without around-the-clock monitoring, an intrusion may go unnoticed for days — long enough for an attacker to move from one mailbox to the organization's financial records. By the time the phone calls start, as they did for Malone, the damage is already in motion.

There is another layer of difficulty. AI lets attackers scale. One operator can now run campaigns against hundreds of targets at once. Defenders, meanwhile, still work one alert at a time, and under-resourced teams drown quickly.

Practical Steps Under-Resourced Organizations Can Take Now

The most effective defenses remain stubbornly unglamorous, and security practitioners who advise small organizations say the basics still stop most attacks. Turn on multifactor authentication everywhere, especially for email and banking. Train staff to verify money-transfer requests by phone using a number they already have on file — never one provided in the request itself. Patch software on a schedule, and back up critical data offline so ransomware can't encrypt the only copy.

CISA offers free vulnerability scanning and tabletop exercise resources tailored to small and mid-sized organizations, and the FBI's field offices maintain outreach programs for local businesses. Regional nonprofit associations and state banking leagues frequently run low-cost security workshops. Incident-response firms increasingly offer flat-fee retainers for smaller clients, so a crisis doesn't arrive with an open-ended invoice.

Perhaps the most underrated step is community. When Vivian's Door was hit, its first warning came from the businesses it serves — people who noticed something wrong and picked up the phone. Shared threat information among neighboring organizations turns isolated victims into an early-warning network.

The Broader Stakes: Community Trust and Digital Resilience

Vivian's Door exists to help businesses that the mainstream financial system often overlooks. When its systems were compromised, the damage wasn't measured only in dollars. It was measured in trust — the currency every nonprofit runs on. That's the real stake in this fight. A hospital that cancels surgeries, a bank that freezes accounts, a nonprofit that exposes its clients' data: each incident chips away at the confidence communities place in the institutions that anchor local life.

AI-powered cyberattacks will not slow down. The tools will get cheaper and better. But the organizations most at risk are not defenseless. The gap between a successful attack and a failed one is often a single enabled security setting, a single skeptical phone call, a single shared warning. Malone's phone kept ringing — because someone, somewhere, didn't make that call. The question for every local institution is whether they'll make it before the next attack arrives.

Source: The Verge